Computer hacking, malware, worms, and other computer related mischief undertaken or caused by people with either benign or malicious intent is of grave concern to businesses, particularly those that rely on expansive computer networks. Indeed, a breach of an organization's network, including even a single computer on that network, may result in direct and indirect financial loss, the latter including loss associated with legal fees, fines, etc.
In is therefore important for organizations to have as much control and understanding as possible of the nature of their computer networks. In connection with this understanding, it is important to have an idea of the type of data, and particularly whether “sensitive data” resides or happens to be stored on given computers at any given time.
Sensitive data is typically defined one of two ways. It can include data types that are protected though policies and regulations such as the Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Management Act (FISMA), Sarbanes-Oxley Act (SOX), and Payment Card Industry Standards (PCI), where the data may include social security numbers (SSNs), credit card numbers, bank account numbers, phone numbers and addresses, or the like; or sensitive data can include data types that are specific to an organization, such as customer ID numbers, board meeting minutes, source code, designs, recipes, trade secrets, and the like.
Only a small handful of products presently available in the marketplace are capable of scanning a computer for “sensitive data.” Significantly, however, such products neglect the security of that data.
Security is typically defined as the controls employed to prevent unauthorized access to given data. While there exist products that are capable of assessing the security of a given computer (e.g., by detecting malware, viruses, mis-configurations, restricted applications, etc.), such products do not have the ability to determine whether data stored on given computer, which computer is deemed to be a security risk, is considered “sensitive.”
There is accordingly a need to provide more comprehensive methods and systems that can provide computer network managers the ability to have confidence that sensitive data is not being compromised, or that the chances of such a compromise is reduced as much as possible.